deps: bump the all-go-dependencies group across 1 directory with 17 updates by dependabot[bot] · Pull Request #138 · chainreactors/cyber-harness

dependabot · 2026-09-19T09:41:42Z

Bumps the all-go-dependencies group with 17 updates in the / directory:

Package	From	To
connectrpc.com/connect	`1.20.0`	`1.21.0`
github.com/alecthomas/chroma/v2	`2.14.0`	`2.27.0`
github.com/carapace-sh/carapace	`1.11.6`	`1.16.1`
github.com/charmbracelet/glamour	`0.8.0`	`1.0.0`
github.com/gookit/config/v2	`2.2.8`	`2.2.9`
github.com/mattn/go-runewidth	`0.0.23`	`0.0.30`
github.com/projectdiscovery/goflags	`0.1.75`	`0.2.1`
github.com/projectdiscovery/gologger	`1.1.71`	`1.1.73`
github.com/projectdiscovery/utils	`0.11.1`	`0.11.5`
golang.org/x/image	`0.42.0`	`0.46.0`
golang.org/x/sys	`0.46.0`	`0.48.0`
golang.org/x/term	`0.44.0`	`0.45.0`
google.golang.org/protobuf	`1.36.11`	`1.36.12`
modernc.org/sqlite	`1.45.0`	`1.59.0`
github.com/charmbracelet/lipgloss	`1.1.0`	`1.1.1-0.20250404203927-76690c660834`
github.com/stretchr/testify	`1.11.1`	`1.12.1`
github.com/yuin/goldmark	`1.7.4`	`1.7.13`

Updates connectrpc.com/connect from 1.20.0 to 1.21.0

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers. The new handler option WithRequestGate runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the documentation for details.

Governance

Add pkwarren as a maintainer by @bufdev in connectrpc/connect-go#929 🎉

Enhancements

Add WithRequestGate handler option by @emcfarlane in connectrpc/connect-go#962

Create release binary for protoc-gen-connect-go by @emcfarlane in connectrpc/connect-go#966

Bugfixes

Fix issue with user-agent getting inappropriately injected into request headers by @jhump in connectrpc/connect-go#934

Fix client streaming operations blocking indefinitely after context cancellation by @haru0017 in connectrpc/connect-go#937

Fix flaky HTTP2 testcase assertion by @emcfarlane in connectrpc/connect-go#940

Fix data race and connection leak in duplexHTTPCall by @emcfarlane in connectrpc/connect-go#938

Fix off-by-one in WithHTTPGetMaxURLSize URL length check by @fchimpan in connectrpc/connect-go#955

Fix connect.WithGRPC typo in the missing client option error by @NotAFlightRisk in connectrpc/connect-go#956

Only send a 304 when the request was a GET by @NotAFlightRisk in connectrpc/connect-go#957

Fix panic in stream Spec and Peer when client construction failed by @NotAFlightRisk in connectrpc/connect-go#959

Fix dropped headers on errStreamingClientConn by @mohit-bhandari45 in connectrpc/connect-go#964

New Contributors

@haru0017 made their first contribution in connectrpc/connect-go#937

@dongjiang1989 made their first contribution in connectrpc/connect-go#945

@fchimpan made their first contribution in connectrpc/connect-go#955

@NotAFlightRisk made their first contribution in connectrpc/connect-go#956

@mohit-bhandari45 made their first contribution in connectrpc/connect-go#964

Full Changelog: connectrpc/connect-go@v1.20.0...v1.21.0

Commits

41b7f30 Prepare for v1.21.0 (#972)
6058c20 Fix dropped headers on errStreamingClientConn (#964)
014693a Refine WithRequestGate API and documentation (#968)
d9b4b1d Create release binary for protoc-gen-connect-go (#966)
5111260 Add WithRequestGate handler option (#962)
febfc19 Fix panic in stream Spec and Peer when client construction failed (#959)
cb5da57 Update Go version for CI (#958)
9646326 Only send a 304 when the request was a GET (#957)
2a02fea Fix connect.WithGRPC typo in the missing client option error (#956)
eae42d2 Fix off-by-one in WithHTTPGetMaxURLSize URL length check (#955)
Additional commits viewable in compare view

Updates github.com/alecthomas/chroma/v2 from 2.14.0 to 2.27.0

Release notes

Sourced from github.com/alecthomas/chroma/v2's releases.

v2.27.0

Changelog

a6d00fe fix(html): make mode class output opt-in via WithModeClasses

f52d015 chore: some house-keeping

f08a9ab chore: add fmt + test to BUILD.bit

6da8f88 fix(yaml): comments can be key-values (#1289)

67785a4 chore(deps): update all non-major dependencies (#1285)

d9dd73f Add templ XML lexer (#1283)

effffdb chore(deps): update all non-major dependencies (#1280)

03236a4 support for PostScript font files (#1282)

e10d532 Fix YAML slash comments with colons (#1278)

v2.26.1

Changelog

56c7702 fix: downgrade go.mod version to 1.25

v2.26.0

Changelog

a4d3f60 feat(chromad): use style counterparts for theme switching

ce159e6 chore: migrate to new bit format

180ea9f perf(colour): replace Sprintf/ParseUint round-trip in NewColour with direct bit arithmetic (#1274)

68a08b0 docs: how to support dynamic theme switching

6fb9d92 feat(html): tag output with style mode

a71fea3 feat(styles): add light/dark mode support

v2.25.0

Changelog

c3826f0 chore: go mod tidy

fb5bc39 fix: emit HTTP body tokens without Coalesce

a3c2946 Improve Nu file detection (#1260)

e841b1a chore(deps): update all non-major dependencies (#1272)

3ed2db8 Add Gemfile.lock lexer (& ruby improvements) (#1269)

41fb546 Add YAML+Jinja lexer (#1268)

e99b881 chore(deps): update all non-major dependencies (#1263)

e67dd2f (Markless) Fix parse issue for embed directives without options (#1266)

dffa370 fix(go): tokenize trailing // as comment instead of consuming next line (#1265)

1cf1560 chore: upgrade to github.com/dlclark/regexp2/v2

2cbcf7b chore: upgrade golangci-lint

786675b chore(deps): update all non-major dependencies (#1257)

235590c feat: add JSONL support to JSON lexer (#1262)

f9b5c97 fix(dart): match single-line comments without trailing newline (#1225) (#1261)

097f8e9 Mention Arturo in README (#1256)

d46ce60 feat(markdown): highlight frontmatter and comments (#1245)

f786b2a feat(lexers): add support for LilyPond (#1255)

0a02b98 chore(deps): update actions/checkout digest to de0fac2 (#1212)

c55009e Fix AGENTS.md referencing a non-existent scripts directory (#1231)

c5e763e Improve protobuf lexer (#1253)

113cd0e Add Arturo lexer (#1232)

4498d71 chore(deps): update dependency binaryen to v129 (#1238)

885f912 Added f4 to "Projects using Chroma" list (#1242)

... (truncated)

Commits

a6d00fe fix(html): make mode class output opt-in via WithModeClasses
f52d015 chore: some house-keeping
f08a9ab chore: add fmt + test to BUILD.bit
6da8f88 fix(yaml): comments can be key-values (#1289)
67785a4 chore(deps): update all non-major dependencies (#1285)
d9dd73f Add templ XML lexer (#1283)
effffdb chore(deps): update all non-major dependencies (#1280)
03236a4 support for PostScript font files (#1282)
e10d532 Fix YAML slash comments with colons (#1278)
56c7702 fix: downgrade go.mod version to 1.25
Additional commits viewable in compare view

Updates github.com/carapace-sh/carapace from 1.11.6 to 1.16.1

Release notes

Sourced from github.com/carapace-sh/carapace's releases.

v1.16.1

Changelog

dbc7e94f02e35f01a626367a1565267e2c83f527 Merge pull request #1292 from carapace-sh/exclusiveflags-local-only

45aa955f99c09963ae67fc66499f279a517eea73 spec: only collect exclusiveflags from local and own persistent flags

v1.16.0

Changelog

62fa4349729a4961c3c895ab66ab91038dec8fc6 Merge pull request #1291 from carapace-sh/spec-format-update

ce3537cd5df999e564e2c7fb111d9dcf73bcdef1 spec: skip extended flag notation for zero-value defaults

4a3cb84957bdc98d17e19bca07d057b858b64e2a docs: update spec reference for type ownership and exclusive flags

7bd07c505d930bf39c27696ac399c6b9d95e3088 spec: populate exclusiveflags from cobra mutually exclusive annotations

e62a636913b91cb3b817c29d8e64676c37c2f4b1 spec: move canonical spec types to carapace/pkg/command

49aef8c915cd317ac9540a8ef4943bc171e05a04 spec: update generated YAML format to match carapace-spec v1.8

58221d52054c302c9776ea62cad4925c0b64fbca Merge pull request #1290 from carapace-sh/spec-fix-indent

957395778e8240f98db0904c8f4425daf688fcaf spec: fix indendation

1d555564ad0b183e884655852dfa0883550c6fad Merge pull request #1289 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.9

824dd79bb8204c8b1f1bb6ec480cae8ae8fd6508 build(deps): bump github/codeql-action from 4.37.8 to 4.37.9

v1.15.3

Changelog

87a3fe27a8654bc34645a283102f4151babf048b Merge pull request #1287 from carapace-sh/fix/env-var-leak

5aee3681af3e1074e6f093163533b3b0761229da fix: remove CARAPACE_SHELL env var from all shell snippets

0bcaa3d2532099d12e7371b57b316fee8e510db5 Merge pull request #1286 from carapace-sh/darwin-sysctl

ba948c065ba1b5a98481db0dd3e771f572a90a59 fix: use PID-specific sysctl on macOS to avoid full process table scan

v1.15.2

No release notes provided.

v1.15.1

Changelog

99e94b56840f201083d0e51ea36507ab86c19e2e Merge pull request #1279 from carapace-sh/fix/darwin-process-table-scan

23944b8eee9bac3f97678155b7d170f7a92a3661 fix: avoid macOS process table scan when shell is already known

04feb78c0ff06e0e0cade88c3d3614a5b7de5f84 Merge pull request #1277 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.6

1576016685ce950ae93e322ea883b518db5670b5 build(deps): bump github/codeql-action from 4.37.5 to 4.37.6

26aeef2e6ab007b245de9946721746e4d7c4475f Merge pull request #1276 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.5

83edaf3613f995e77d397b01ee9166ccc7d3ace2 build(deps): bump github/codeql-action from 4.37.4 to 4.37.5

v1.15.0

Changelog

58a55f0eaa56e9387fc7d6800cd1b9531431d1d0 Merge pull request #1275 from carapace-sh/docs/carapace-dev-pflag-delimiter-disabled

ffac8c585278cba42275c020fb3beebd20160ae0 Document delimiter-disabled optarg attached values in carapace-dev skill

14967526cc021932be66a31c160dd16392f21362 feat/optarg delimiter attached (#1272)

30d1cbf48523182d5c42de3be440eb19d472cce0 Merge pull request #1273 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.4

e72227b11eb47ccbba75c32169c5a5c277a930c3 build(deps): bump github/codeql-action from 4.37.3 to 4.37.4

b3f65d47fcca704a9b5ad674c29105523b19c700 Merge pull request #1271 from carapace-sh/keywords-enabled-disabled

3f975d5abfe895c322572f76f473155527ce3467 style: added en-/disabled keywords

8f8d4637c5d66c8b5257579c3f19fd90512eb010 Merge pull request #1270 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.3

d773945ce83fc44992d3a504b3a9d6b7a562b507 build(deps): bump github/codeql-action from 4 to 4.37.3

066da3950bd4c3214d9ba44e2c132a0a66019171 Merge pull request #1269 from carapace-sh/update-carapace-dev-skill

b5fde5bf4847fabf59aacf3adecdb239790e7fbf Update carapace-dev skill for flag prefix and ArgumentStyle changes

... (truncated)

Commits

dbc7e94 Merge pull request #1292 from carapace-sh/exclusiveflags-local-only
45aa955 spec: only collect exclusiveflags from local and own persistent flags
62fa434 Merge pull request #1291 from carapace-sh/spec-format-update
ce3537c spec: skip extended flag notation for zero-value defaults
4a3cb84 docs: update spec reference for type ownership and exclusive flags
7bd07c5 spec: populate exclusiveflags from cobra mutually exclusive annotations
e62a636 spec: move canonical spec types to carapace/pkg/command
49aef8c spec: update generated YAML format to match carapace-spec v1.8
58221d5 Merge pull request #1290 from carapace-sh/spec-fix-indent
9573957 spec: fix indendation
Additional commits viewable in compare view

Updates github.com/charmbracelet/glamour from 0.8.0 to 1.0.0

Release notes

Sourced from github.com/charmbracelet/glamour's releases.

v0.10.0

Actually readable tables

Big tables that included links were always hard to read. Links can be very long, and tables often have limited space to render them. This means that links often took the space of many lines and weren't properly clickable because they were being truncated in practice.

Starting on this release, Glamour will render links and images at the footer of the table, with a reference number so you can easily find the link you're looking for. If you want the old behavior, it is still supported via the new WithInlineTableLinks option.

The New Way

The Old Way

Wanna render tables with inline links? You still can:
r, err := glamour.NewTermRenderer(glamour.WithInlineTableLinks(true))
if err != nil { /*...*/ }
out, err := r.RenderBytes(in)
if err != nil { /.../ }
fmt.Fprintf(os.Stdout, "%s\n", out)
Prettier GitHub links

We also introduced a change so that GitHub links inside tables that reference issues, discussions or PRs will be shown in its shortened form, similar to how GitHub itself present the links on issue descriptions: owner/repo#123.

Extra

Also, we introduced WithTableWrap, so you can disable table text wrapping if really want:
r, err := glamour.NewTermRenderer(glamour.WithTableWrap(false))
if err != nil { ... }
out, err := r.RenderBytes(in)
if err != nil { ... }
fmt.Fprintf(os.Stdout, "%s\n", out)
Changelog

New Features

... (truncated)

Commits

69661fd chore(deps): bump actions/checkout from 5 to 6 in the all group (#491)
0af1a2d chore(deps): bump the all group with 2 updates (#482)
a9ec019 chore(deps): bump github.com/charmbracelet/x/ansi in the all group (#477)
7a4cf0c ci: sync dependabot config (#476)
49c8248 chore(deps): bump the all group with 2 updates (#472)
c1ce505 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#471)
f9c650c ci: sync dependabot config (#470)
e3c481b chore(deps): bump actions/checkout from 4 to 5 (#469)
7209389 chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 (#468)
f447e14 chore(deps): bump github.com/charmbracelet/x/ansi from 0.9.3 to 0.10.1 (#467)
Additional commits viewable in compare view

Updates github.com/gookit/config/v2 from 2.2.8 to 2.2.9

Release notes

Sourced from github.com/gookit/config/v2's releases.

v2.2.9

Change Log

Fixed

fix(read): Duration() parses Go duration strings (e.g. "300s", "1h30m") (#218) gookit/config@94aa2e8

fix(reload): reset data before reloading files gookit/config@6a3fe04

Other

build(deps): bump github.com/gookit/goutil from 0.7.5 to 0.7.6 (#215) gookit/config@fc79c1b

build(deps): bump WillAbides/setup-go-faster from 1.15.0 to 1.19.0 (#214) gookit/config@c345d01

build(deps): bump actions/checkout from 6 to 7 (#216) gookit/config@e4ef650

build(deps): bump github.com/gookit/goutil from 0.7.6 to 0.8.0 (#217) gookit/config@99340a5

docs(watch): debounce reload example gookit/config@78c5e7e

ci: update ci testing go version gookit/config@0edfefc

Commits

0edfefc ci: update ci testing go version
78c5e7e docs(watch): debounce reload example
6a3fe04 fix(reload): reset data before reloading files
94aa2e8 fix(read): Duration() parses Go duration strings (e.g. "300s", "1h30m") (#218)
99340a5 build(deps): bump github.com/gookit/goutil from 0.7.6 to 0.8.0 (#217)
e4ef650 build(deps): bump actions/checkout from 6 to 7 (#216)
c345d01 build(deps): bump WillAbides/setup-go-faster from 1.15.0 to 1.19.0 (#214)
fc79c1b build(deps): bump github.com/gookit/goutil from 0.7.5 to 0.7.6 (#215)
See full diff in compare view

Updates github.com/mattn/go-runewidth from 0.0.23 to 0.0.30

Commits

14205cc Merge pull request #110 from mattn/truncate-rune-fast-path
67f0b8d Take the rune fast path in the Truncate functions too
a42811d Merge pull request #111 from mattn/wrap-invalid-utf8
1156ade Keep strings that are not valid UTF-8 on the segmenter
06120a9 Merge pull request #109 from mattn/skip-segmentation-without-joiners
21388ad Skip grapheme segmentation for text that cannot form clusters
6c7068f Generate a table of runes that can join a grapheme cluster
2793dc5 Merge pull request #108 from youdie006/fix-wrap-grapheme-cluster
fd7c07f Add Wrap benchmarks for the ASCII, CJK and emoji paths
f5f115c Inline the ASCII width rule in the Wrap fast path
Additional commits viewable in compare view

Updates github.com/projectdiscovery/goflags from 0.1.75 to 0.2.1

Release notes

Sourced from github.com/projectdiscovery/goflags's releases.

Release v0.2.1

0.2.1 (2026-09-06)

Release v0.2.0

0.2.0 (2026-08-31)

Features

add cascading yaml layers (37d6af4)

Tests

make source path assertions portable (4450b76)

Code Refactoring

refresh max-time after config merges (ae90f84)

Release v0.1.76

0.1.76 (2026-08-11)

Bug Fixes

multibyte value parsing (ab0b9c5), closes projectdiscovery/nuclei#7645 #251

Commits

99acb21 Merge pull request #255 from arpitjain099/fix/stable-enum-help
d80a134 sort enums
1523a7c Sort the allowed values so enum help and errors are stable
23ce2fd Merge pull request #254 from projectdiscovery/dwisiswant0/feat/add-cascading-...
0fc37ce document rollback
4450b76 test: make source path assertions portable
ae90f84 refactor: refresh max-time after config merges
37d6af4 feat: add cascading yaml layers
c2b50c5 Merge pull request #252 from projectdiscovery/dwisiswant0/fix/multibyte-value...
3586e89 bump go
Additional commits viewable in compare view

Updates github.com/projectdiscovery/gologger from 1.1.71 to 1.1.73

Release notes

Sourced from github.com/projectdiscovery/gologger's releases.

Release v1.1.73

1.1.73 (2026-09-13)

Release v1.1.72

1.1.72 (2026-08-09)

Commits

e93efa1 Merge pull request #154 from projectdiscovery/fix-maxlevel-race
5dcf3a6 fix race
f047aad Merge pull request #153 from projectdiscovery/dependabot/github_actions/main/...
e792122 Merge pull request #152 from projectdiscovery/dependabot/github_actions/main/...
4d36837 Merge pull request #151 from projectdiscovery/dependabot/github_actions/main/...
520bbbc chore(deps): bump actions/setup-go from 6 to 7
7fd8ed1 chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
b51f41b chore(deps): bump actions/checkout from 6 to 7
See full diff in compare view

Updates github.com/projectdiscovery/utils from 0.11.1 to 0.11.5

Release notes

Sourced from github.com/projectdiscovery/utils's releases.

v0.11.5

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

Fix ConnReadN goroutine leak when stop races cancellation by @dogancanbakir in projectdiscovery/utils#777

fix(jarm): enforce deadline and use maintained module by @knakul853 in projectdiscovery/utils#772

chore(deps): bump the modules group across 1 directory with 6 updates by @dependabot[bot] in projectdiscovery/utils#779

New Contributors

@knakul853 made their first contribution in projectdiscovery/utils#772

Full Changelog: projectdiscovery/utils@v0.11.4...v0.11.5

v0.11.4

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

add shared llm provider layer by @dogancanbakir in projectdiscovery/utils#774

Full Changelog: projectdiscovery/utils@v0.11.3...v0.11.4

v0.11.3

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

fix(ci): patch-bump on any commits in Bump Version workflow by @dogancanbakir in projectdiscovery/utils#766

fix: prevent goroutine leak on context-cancelled reads (contextutil + reader.ConnReadN) by @G360-Niek in projectdiscovery/utils#761

New Contributors

@G360-Niek made their first contribution in projectdiscovery/utils#761

Full Changelog: projectdiscovery/utils@v0.11.2...v0.11.3

v0.11.2

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

... (truncated)

Commits

c9a5307 chore(deps): bump the modules group across 1 directory with 6 updates (#779)
5046549 fix(jarm): enforce deadline and use maintained module (#772)
d8fe1f3 Merge pull request #777 from projectdiscovery/fix/776-conn-read-leak-test
02662dd fix ConnReadN leaking a read goroutine when stop races cancellation
d99a29b Merge pull request #774 from projectdiscovery/feat/llm-provider
0281172 harden llm
8e42f58 fix unchecked error return flagged by errcheck
50ff53a allow explicit api key in config
c49f0d3 add shared llm provider layer
8cc5517 Merge pull request #761 from guardian360/fix/contextutil-goroutine-leak
Additional commits viewable in compare view

Updates golang.org/x/image from 0.42.0 to 0.46.0

Commits

b06f1de go.mod: update golang.org/x dependencies
09b0b4f all: upgrade go directive to at least 1.26.0 [generated]
3ebddc7 go.mod: update golang.org/x dependencies
981eaa0 vp8l: avoid allocating many unused Huffman tree groups
315273a vector: using golang.org/x/sys/cpu for feature detection
891abcb go.mod: update golang.org/x dependencies
f50490d font: document (lack of) security hardening in font packages
7a0cfda webp: check for VP8L dimension mismatch before allocation
4339315 tiff: consistently skip horizontal padding in tiled images
b5baf41 tiff: avoid overflow when reading IFD entries
Additional commits viewable in compare view

Updates golang.org/x/sys from 0.46.0 to 0.48.0

Commits

613e257 cpu: add riscv64 hwprobe drift test
6f7b10f unix: add MLOCK_ONFAULT constant
663e7c8 cpu: add basic support for GOARCH=sparc64
de5f12f cpu: add ppc64le POWER10 detection
80e8acf unix: run go fix
1e3c182 unix: add IPMI interface
d429e20 unix: stop generating sparc termbits from the generic header
bd3bddf unix: add missing HWTSTAMP_* constants
e812f53 windows: add SO_SNDTIMEO constant for socket options
f6989c5 unix: align Ifreq so its union accessors cannot fault
Additional commits viewable in compare view

Updates golang.org/x/term from 0.44.0 to 0.45.0

Commits

9f69229 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Updates modernc.org/sqlite from 1.45.0 to 1.59.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

2026-09-15 v1.59.1:

Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof. Every connection is opened with SQLITE_OPEN_URI, so in a DSN starting with file: these have always worked; only the driver's own keys were listed. The docstring also spells out the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Documentation only.

Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257).

Add IRP.md, an incident response plan: who runs a response when there are two maintainers in different time zones, how a report is scoped across the three layers this module is built from, the fix path for each, and what to do when a released version is itself the problem -- a published Go module version cannot be recalled, so retract plus a new release is the remedy. Linked from SECURITY.md. Documentation only.

Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Contribution guidance previously existed only in GOVERNANCE.md and HACKING.md, neither of which a first-time contributor is likely to open. Documentation only.

Add SECURITY.md: report a vulnerability through GitHub private vulnerability reporting, a confidential GitLab issue, or the project's Service Desk address, never a public issue. It states what is in scope -- including transpilation faults, where the generated Go does not faithfully implement the C it came from -- that only the latest release is supported, and that a confirmed report is disclosed through a GitHub advisory, an entry in the Go vulnerability database so govulncheck reports it, and a release note. Documentation only.

Ship a Software Bill of Materials: sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), both validated against the published schemas, with SBOM.md explaining what they cover. They name what an SBOM built from the module graph cannot see -- the transpiled SQLite 3.53.4 and sqlite-vec C, and the upstreams modernc.org/libc vendors, musl among them -- and mark every component as linked into your binary, test-only, or compiled into nothing. Documentation only.

Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries: the whole Go module graph, the transpiled SQLite and sqlite-vec C that no go.mod names, and the upstreams modernc.org/libc carries in turn, musl among them. It reproduces all seventeen distinct license texts in full and separates what is linked into your binary from what only appears in the module graph. The LICENSE name prefix is what makes go mod vendor carry it into downstream vendor/ trees. Documentation only.

2026-09-15 v1.59.0:

Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).

Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!

Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

2026-09-01 v1.58.0:

Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).

Resolves [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255). See [GitLab merge request #136](https://gitlab.com/cznic/sqlite/-/merge_requests/136), thanks Nathan Herring (@technosloth), and thanks Gani Georgiev (@ganigeorgiev) for pressing the opt-in default!

2026-08-19 v1.57.0:

Add an opt-in _defensive DSN query parameter turning on SQLite's defensive mode for the connection. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables and to sqlite_dbpage fail. It is a hardening measure, not a sandbox for hostile database files, for which it is only one of the steps SQLite recommends, and it is a property of the connection, not of the file. Absent, or _defensive=0, nothing changes.

Reject _defensive=1 together with _journal_mode=OFF (or _journal=OFF) instead of opening a connection in which neither was honoured: SQLite turns that PRAGMA into a no-op that still reports success. Only DSNs using the new parameter can be affected. See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!

Ship the sqlite-vec license notice this module has been missing since vec/ arrived in v1.47.0. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT; the text now ships as LICENSE-SQLITE_VEC, and make vendor fails rather than quietly dropping it.

The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged. The rename is what makes go mod vendor carry both notices into downstream vendor/ trees: it selects license files by name prefix, so a name merely ending in LICENSE was never propagated.

Let a caller-constructed Driver register its own functions, collations and virtual table modules, through new RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule methods plus Must* variants, and let vtab.RegisterModule honour its db argument. Behavior change: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard db and land on the registered sqlite driver, reaching every connec...
Description has been truncated

dependabot · 2026-09-19T09:41:43Z

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…pdates Bumps the all-go-dependencies group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `1.20.0` | `1.21.0` | | [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.14.0` | `2.27.0` | | [github.com/carapace-sh/carapace](https://github.com/carapace-sh/carapace) | `1.11.6` | `1.16.1` | | [github.com/charmbracelet/glamour](https://github.com/charmbracelet/glamour) | `0.8.0` | `1.0.0` | | [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.8` | `2.2.9` | | [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) | `0.0.23` | `0.0.30` | | [github.com/projectdiscovery/goflags](https://github.com/projectdiscovery/goflags) | `0.1.75` | `0.2.1` | | [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.71` | `1.1.73` | | [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.11.1` | `0.11.5` | | [golang.org/x/image](https://github.com/golang/image) | `0.42.0` | `0.46.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.46.0` | `0.48.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.44.0` | `0.45.0` | | google.golang.org/protobuf | `1.36.11` | `1.36.12` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.45.0` | `1.59.0` | | [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss) | `1.1.0` | `1.1.1-0.20250404203927-76690c660834` | | [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` | | [github.com/yuin/goldmark](https://github.com/yuin/goldmark) | `1.7.4` | `1.7.13` | Updates `connectrpc.com/connect` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/connectrpc/connect-go/releases) - [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md) - [Commits](connectrpc/connect-go@v1.20.0...v1.21.0) Updates `github.com/alecthomas/chroma/v2` from 2.14.0 to 2.27.0 - [Release notes](https://github.com/alecthomas/chroma/releases) - [Commits](alecthomas/chroma@v2.14.0...v2.27.0) Updates `github.com/carapace-sh/carapace` from 1.11.6 to 1.16.1 - [Release notes](https://github.com/carapace-sh/carapace/releases) - [Commits](carapace-sh/carapace@v1.11.6...v1.16.1) Updates `github.com/charmbracelet/glamour` from 0.8.0 to 1.0.0 - [Release notes](https://github.com/charmbracelet/glamour/releases) - [Commits](charmbracelet/glamour@v0.8.0...v1.0.0) Updates `github.com/gookit/config/v2` from 2.2.8 to 2.2.9 - [Release notes](https://github.com/gookit/config/releases) - [Commits](gookit/config@v2.2.8...v2.2.9) Updates `github.com/mattn/go-runewidth` from 0.0.23 to 0.0.30 - [Commits](mattn/go-runewidth@v0.0.23...v0.0.30) Updates `github.com/projectdiscovery/goflags` from 0.1.75 to 0.2.1 - [Release notes](https://github.com/projectdiscovery/goflags/releases) - [Commits](projectdiscovery/goflags@v0.1.75...v0.2.1) Updates `github.com/projectdiscovery/gologger` from 1.1.71 to 1.1.73 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](projectdiscovery/gologger@v1.1.71...v1.1.73) Updates `github.com/projectdiscovery/utils` from 0.11.1 to 0.11.5 - [Release notes](https://github.com/projectdiscovery/utils/releases) - [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md) - [Commits](projectdiscovery/utils@v0.11.1...v0.11.5) Updates `golang.org/x/image` from 0.42.0 to 0.46.0 - [Commits](golang/image@v0.42.0...v0.46.0) Updates `golang.org/x/sys` from 0.46.0 to 0.48.0 - [Commits](golang/sys@v0.46.0...v0.48.0) Updates `golang.org/x/term` from 0.44.0 to 0.45.0 - [Commits](golang/term@v0.44.0...v0.45.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 Updates `modernc.org/sqlite` from 1.45.0 to 1.59.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.45.0...v1.59.0) Updates `github.com/charmbracelet/lipgloss` from 1.1.0 to 1.1.1-0.20250404203927-76690c660834 - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/commits) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `github.com/yuin/goldmark` from 1.7.4 to 1.7.13 - [Release notes](https://github.com/yuin/goldmark/releases) - [Commits](yuin/goldmark@v1.7.4...v1.7.13) --- updated-dependencies: - dependency-name: connectrpc.com/connect dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/alecthomas/chroma/v2 dependency-version: 2.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/carapace-sh/carapace dependency-version: 1.16.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/charmbracelet/glamour dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-go-dependencies - dependency-name: github.com/charmbracelet/lipgloss dependency-version: 1.1.1-0.20250404203927-76690c660834 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/gookit/config/v2 dependency-version: 2.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/mattn/go-runewidth dependency-version: 0.0.30 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/goflags dependency-version: 0.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.73 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/utils dependency-version: 0.11.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/yuin/goldmark dependency-version: 1.7.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: golang.org/x/image dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-22T06:24:12Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot force-pushed the dependabot/go_modules/all-go-dependencies-8b2a5d6e14 branch from 832f2c7 to 3e7e381 Compare September 20, 2026 20:05

M09Ic force-pushed the master branch from 27b1c1a to fec9270 Compare September 21, 2026 10:30

M09Ic force-pushed the dependabot/go_modules/all-go-dependencies-8b2a5d6e14 branch from 3e7e381 to 3e2083b Compare September 21, 2026 10:30

dependabot Bot force-pushed the dependabot/go_modules/all-go-dependencies-8b2a5d6e14 branch from 3e2083b to dc07d6c Compare September 21, 2026 11:47

dependabot Bot closed this Sep 22, 2026

dependabot Bot deleted the dependabot/go_modules/all-go-dependencies-8b2a5d6e14 branch September 22, 2026 06:24

Navigation Menu

deps: bump the all-go-dependencies group across 1 directory with 17 updates - #138

deps: bump the all-go-dependencies group across 1 directory with 17 updates#138
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-8b2a5d6e14

dependabot Bot commented on behalf of github Sep 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.21.0

What's Changed

Governance

Enhancements

Bugfixes

New Contributors

v2.27.0

Changelog

v2.26.1

Changelog

v2.26.0

Changelog

v2.25.0

Changelog

v1.16.1

Changelog

v1.16.0

Changelog

v1.15.3

Changelog

v1.15.2

v1.15.1

Changelog

v1.15.0

Changelog

v0.10.0

Actually readable tables

The New Way

The Old Way

Prettier GitHub links

Extra

Changelog

New Features

v2.2.9

Change Log

Fixed

Other

Release v0.2.1

0.2.1 (2026-09-06)

Release v0.2.0

0.2.0 (2026-08-31)

Features

Tests

Code Refactoring

Release v0.1.76

0.1.76 (2026-08-11)

Bug Fixes

Release v1.1.73

1.1.73 (2026-09-13)

Release v1.1.72

1.1.72 (2026-08-09)

v0.11.5

What's Changed

New Contributors

v0.11.4

What's Changed

v0.11.3

What's Changed

New Contributors

v0.11.2

What's Changed

Changelog

Uh oh!

dependabot Bot commented on behalf of github Sep 19, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github Sep 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 19, 2026 •

edited

Loading